<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">Hi,<br class=""><div><br class=""><blockquote type="cite" class=""><div class="">On Mar 25, 2021, at 12:16, 张驰斌 <<a href="mailto:zhangchb1@shanghaitech.edu.cn" class="">zhangchb1@shanghaitech.edu.cn</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><meta charset="UTF-8" class=""><div class="WordSection1" style="page: WordSection1; caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><div style="margin: 0cm; text-align: justify; font-size: 10.5pt; font-family: DengXian;" class=""><span lang="EN-US" class="">Hi Florian,</span></div><div style="margin: 0cm; text-align: justify; font-size: 10.5pt; font-family: DengXian;" class=""><span lang="EN-US" class=""> It</span>’<span lang="EN-US" class="">s been a while since I lasted posted a reply on this mailing list. I</span>’<span lang="EN-US" class="">ve been going through code in the FuzzMutate folder and commit<span class="Apple-converted-space"> </span><a href="https://reviews.llvm.org/D96654" style="color: blue; text-decoration: underline;" class="">https://reviews.llvm.org/D96654</a><span class="Apple-converted-space"> </span>for quite some time now. While the current IRMutator implementation allows for module / function level mutation, only instruction level mutations are implemented, namely instruction injection and deletion, which does not preserve the original semantics of the program. </span></div></div></div></blockquote><div><br class=""></div><div>Yes, I think the current IR mutators only remove or add a subset of instructions, and can add/drop some flags. They may create programs with different behavior to the corpus, but that’s exactly what makes fuzzing interesting (new code example to test).</div><br class=""><blockquote type="cite" class=""><div class=""><div class="WordSection1" style="page: WordSection1; caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><div style="margin: 0cm; text-align: justify; font-size: 10.5pt; font-family: DengXian;" class=""><span lang="EN-US" class="">I think the sound mutation rule examples provided by Johannes is something I work on in the summer.</span></div></div></div></blockquote><div><br class=""></div>Sounds good. As part of the proposal, it would probably be good to expand on what type of soundness you are aiming for (e.g. do not introduce new undefined behavior). I think the challenge will be on how can we make sure to generate the most interesting programs given that constraint. An example of an existing mutator that may introduce UB is the one that adds or removes nuw/nsw to/from existing instructions.<br class=""><br class=""><blockquote type="cite" class=""><div class=""><div class="WordSection1" style="page: WordSection1; caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><div style="margin: 0cm; text-align: justify; font-size: 10.5pt; font-family: DengXian;" class=""><span lang="EN-US" class=""> Aside from that, do you see any opportunity that D96654 alive2-based fuzzer could be expanded on, or are there anything that you wished to implement but not yet done (because I see the label NOT-TO-BE-MERGED)?</span></div><div style="margin: 0cm; text-align: justify; font-size: 10.5pt; font-family: DengXian;" class=""><span lang="EN-US" class="">My personal opinion is that it</span>’<span lang="EN-US" class="">s pretty feature complete. Any other advice will be helpful too:)</span></div><div style="margin: 0cm; text-align: justify; font-size: 10.5pt; font-family: DengXian;" class=""><span lang="EN-US" class=""><o:p class=""> </o:p></span></div></div></div></blockquote><br class=""></div><div>It’s just a starting point, but the mechanics are actually quite straight forward. The interesting bit is where can we go from there? Things like can we detect if a generated program has UB and reject it as candidate? (To complement the sound-only mutators) Can we create more interesting candidates without introducing a bunch of UB, which makes the inputs much less interesting, especially when verifying a transform with Alive?</div><div><br class=""></div><div>Cheers,</div><div>Florian</div></body></html>